From patchwork Tue Aug 22 19:13:55 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 9916011 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0DF38603F9 for ; Tue, 22 Aug 2017 19:17:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 04312285F0 for ; Tue, 22 Aug 2017 19:17:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ED1AD2879D; Tue, 22 Aug 2017 19:17:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 76226285F0 for ; Tue, 22 Aug 2017 19:17:10 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dkEdb-0007ke-5W; Tue, 22 Aug 2017 19:14:55 +0000 Received: from mail6.bemta5.messagelabs.com ([195.245.231.135]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dkEdZ-0007kA-Tc for xen-devel@lists.xenproject.org; Tue, 22 Aug 2017 19:14:54 +0000 Received: from [85.158.139.211] by server-5.bemta-5.messagelabs.com id 39/DF-02177-DA28C995; Tue, 22 Aug 2017 19:14:53 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupnkeJIrShJLcpLzFFi42LpubySR3dV05x Igz1XVS2+b5nM5MDocfjDFZYAxijWzLyk/IoE1oyvq28zFjyUqtjxcDdLA+Ml8S5GLg4hgW2M En/7rzJ3MXJwsAmYSsz4r9LFyMkhIqAgsbn3GStIDbNAD7PE1il32UASwgJBEgeur2MFsVkEV CXubWtnArF5BawkVtzqZgSxJQTkJc49uM0MYnMKWEt8fLaCFWS+EFBNx7MAkLCogJjEwXf3oV oFJU7OfMICUsIsoC6xfp7QBEbeWUgysxAyCxiZVjFqFKcWlaUW6Rqa6CUVZaZnlOQmZuboGhq Y6uWmFhcnpqfmJCYV6yXn525iBAYOAxDsYDx72vMQoyQHk5Ior1v2nEghvqT8lMqMxOKM+KLS nNTiQ4wyHBxKErzGjUA5waLU9NSKtMwcYAjDpCU4eJREeOVB0rzFBYm5xZnpEKlTjLocG1av/ 8IkxJKXn5cqJc7rA1IkAFKUUZoHNwIWT5cYZaWEeRmBjhLiKUgtys0sQZV/xSjOwagkzMsHMo UnM68EbtMroCOYgI4wbJ0GckRJIkJKqoGxcW+3ssOfxV9cC4LW/DZhWXdrh5Kf8a94vpf/Jv6 epLijTlWoP+ZbV+ZSzQvdGi4z/ku+fxzh9Vfiy1kXsbNxMq5fT++0l7dYfYn7a1+p6G5T3z+7 7m3W3WnuqrV/aX68wayblalqPFdeSWV8ucW+tsDHO/nPP8HGeq+q6sz44JJj15/2HtusxFKck WioxVxUnAgAx/AeWaICAAA= X-Env-Sender: gregkh@linuxfoundation.org X-Msg-Ref: server-16.tower-206.messagelabs.com!1503429289!92495667!1 X-Originating-IP: [140.211.169.12] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 44503 invoked from network); 22 Aug 2017 19:14:50 -0000 Received: from mail.linuxfoundation.org (HELO mail.linuxfoundation.org) (140.211.169.12) by server-16.tower-206.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 22 Aug 2017 19:14:50 -0000 Received: from localhost (c-73-254-81-106.hsd1.wa.comcast.net [73.254.81.106]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 6FCEC8E3; Tue, 22 Aug 2017 19:14:48 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Date: Tue, 22 Aug 2017 12:13:55 -0700 Message-Id: <20170822190943.024693871@linuxfoundation.org> X-Mailer: git-send-email 2.14.1 In-Reply-To: <20170822190941.918296529@linuxfoundation.org> References: <20170822190941.918296529@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Cc: Juergen Gross , Eduardo Valentin , Thomas Friebel , Greg Kroah-Hartman , Munehisa Kamata , stable@vger.kernel.org, xen-devel@lists.xenproject.org, Boris Ostrovsky , Roger Pau Monne Subject: [Xen-devel] [PATCH 4.12 27/41] xen-blkfront: use a right index when checking requests X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Munehisa Kamata commit b15bd8cb37598afb2963f7eb9e2de468d2d60a2f upstream. Since commit d05d7f40791c ("Merge branch 'for-4.8/core' of git://git.kernel.dk/linux-block") and 3fc9d690936f ("Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block"), blkfront_resume() has been using an index for iterating ring_info to check request when iterating blk_shadow in an inner loop. This seems to have been accidentally introduced during the massive rewrite of the block layer macros in the commits. This may cause crash like this: [11798.057074] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [11798.058832] IP: [] blkfront_resume+0x10a/0x610 .... [11798.061063] Call Trace: [11798.061063] [] xenbus_dev_resume+0x53/0x140 [11798.061063] [] ? xenbus_dev_probe+0x150/0x150 [11798.061063] [] dpm_run_callback+0x3e/0x110 [11798.061063] [] device_resume+0x88/0x190 [11798.061063] [] dpm_resume+0x100/0x2d0 [11798.061063] [] dpm_resume_end+0x11/0x20 [11798.061063] [] do_suspend+0xe8/0x1a0 [11798.061063] [] shutdown_handler+0xfd/0x130 [11798.061063] [] ? split+0x110/0x110 [11798.061063] [] xenwatch_thread+0x86/0x120 [11798.061063] [] ? prepare_to_wait_event+0x110/0x110 [11798.061063] [] kthread+0xd7/0xf0 [11798.061063] [] ? kfree+0x121/0x170 [11798.061063] [] ? kthread_park+0x60/0x60 [11798.061063] [] ? call_usermodehelper_exec_work+0xb0/0xb0 [11798.061063] [] ? call_usermodehelper_exec_async+0x13a/0x140 [11798.061063] [] ret_from_fork+0x25/0x30 Use the right index in the inner loop. Fixes: d05d7f40791c ("Merge branch 'for-4.8/core' of git://git.kernel.dk/linux-block") Fixes: 3fc9d690936f ("Merge branch 'for-4.8/drivers' of git://git.kernel.dk/linux-block") Signed-off-by: Munehisa Kamata Reviewed-by: Thomas Friebel Reviewed-by: Eduardo Valentin Reviewed-by: Boris Ostrovsky Cc: Juergen Gross Cc: Konrad Rzeszutek Wilk Reviewed-by: Roger Pau Monne Cc: xen-devel@lists.xenproject.org Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman --- drivers/block/xen-blkfront.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -2119,9 +2119,9 @@ static int blkfront_resume(struct xenbus /* * Get the bios in the request so we can re-queue them. */ - if (req_op(shadow[i].request) == REQ_OP_FLUSH || - req_op(shadow[i].request) == REQ_OP_DISCARD || - req_op(shadow[i].request) == REQ_OP_SECURE_ERASE || + if (req_op(shadow[j].request) == REQ_OP_FLUSH || + req_op(shadow[j].request) == REQ_OP_DISCARD || + req_op(shadow[j].request) == REQ_OP_SECURE_ERASE || shadow[j].request->cmd_flags & REQ_FUA) { /* * Flush operations don't contain bios, so